FIDO FIDO Deployment & Implementation Architecture

Question 1

What is the primary role of a Relying Party (RP) in a FIDO2 deployment?

Accepted Answer

A web service or application that accepts FIDO-based authentication credentials

Answer

A hardware token manufacturer that produces FIDO-certified devices

Answer

A certificate authority that issues TLS certificates for FIDO servers

Answer

A middleware component that proxies authentication requests to an identity provider

Question 2

Which component in a FIDO2 architecture is responsible for storing the credential public key after registration?

Accepted Answer

The Relying Party server

Answer

The authenticator device

Answer

The FIDO Alliance metadata service

Answer

The WebAuthn browser API

Question 3

During a FIDO2 WebAuthn registration ceremony, what does the Relying Party send to the client to initiate the process?

Accepted Answer

A challenge nonce and RP identity information

Answer

A signed certificate request

Answer

The user's existing password hash

Answer

A one-time password via SMS

Question 4

What is the purpose of the 'origin' validation step performed by the Relying Party during a WebAuthn ceremony?

Accepted Answer

To verify the request originated from the legitimate RP domain, preventing phishing

Answer

To check the geographic location of the user

Answer

To confirm the authenticator firmware version is up to date

Answer

To ensure the user has a valid email address on file

Question 5

In a FIDO2 server implementation, what does the 'rpId' field represent?

Accepted Answer

The effective domain of the Relying Party used to scope credentials

Answer

A unique numeric identifier assigned by the FIDO Alliance

Answer

A session token for the current authentication transaction

Answer

The SHA-256 hash of the server's TLS certificate

Question 6

Which deployment model allows a single FIDO2 credential to be used across multiple services under the same organization?

Accepted Answer

Federated identity with rpId set to the parent domain

Answer

Cross-origin iframe embedding

Answer

Shared secret symmetric key distribution

Answer

SAML 2.0 assertion passing